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Abstract 

The axis compensation is a procedure in which the sender and the receiver 
compensate the axes of their transmitter and detector so that the bit sequence 
can be transmitted more reliably. We show the optimal axis compensations 
maximizing the key generation rate for unital channels. We consider the case 
in which only Bob is allowed to compensate his axis, and the case in which 
both Alice and Bob are allowed to compensate their axes. In the former case, 
we show that we should utilize the mismatched measurement outcomes in 
the channel estimation phase. In the latter case, we show that we do not have 
to utilize the mismatched measurement outcomes in the channel estimation 
phase. 



1 Introduction 

Quantum key distribution (QKD) has attracted great attention as a technology to 
realize the information theoretically secure key agreement. In this paper, we in- 
vestigate the Bennett-Brassard 1984 (BB84) protocol CD and the six-state protocol 
@, and the QKD protocols indicate the BB84 protocol and the six-state protocol. 

Typically in theoretical studies on the QKD protocols, the protocols roughly 
consist of three phases: the bit transmission phase, the channel estimation phase, 
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and the postprocessing phase. In the bit transmission phase, the legitimate sender, 
usually referred to as Alice, sends a bit sequence to the legitimate receiver, usu- 
ally referred to as Bob, by encoding them into qubits. In the channel estimation 
phase, Alice and Bob estimate the channel and the amount of information gained 
by an eavesdropper, usually referred to as Eve. Finally in the postprocessing phase, 
Alice and Bob share a secret key based on their bit sequences obtained in the bit 
transmission phase. 

On the other hand, in the practical QKD protocols, Alice and Bob conduct the 
axis compensation (before the bit transmission phase), in which Alice and Bob 
compensate the axes of their transmitter and detector so that the bit sequence can 
be transmitted more reliably in the bit transmission phase. This axis compensation 
is considered to be indispensable in the QKD protocols, and it has been exten- 
sively studied from the experimental point of view [3j 01 [5] |6j |7] O [9[ (see also 
ifTOl ). However, it has not been theoretically clarified how Alice and Bob should 
compensate the axes in the axis compensation. 

In this paper, we investigate the optimal axis compensation in the sense that the 
key generation rate is maximized, where the key generation rate is defined as the 
ratio between the length of the shared secret key and that of the sequences initially 
possessed by Alice and Bob in the postprocessing phase. 

We consider the following various settings. In the channel estimation phase, 
we consider two kinds of channel estimation: the accurate channel estimation and 
the conventional channel estimation (see ifTTlO . In the accurate channel estima- 
tion, we use the mismatched measurement outcomes, which are bits transmitted 
and received by different bases, in addition to the matched measurement outcomes, 
which are bits transmitted and received by the same bases, to estimate the chan- 
nel. On the other hand, in the conventional channel estimation, we discard the 
mismatched measurement outcomes and only use the matched measurement out- 
comes. The reason why we consider two kind of channel estimation is that the 
authors recently clarified that the key generation rate is increased if we use the ac- 
curate channel estimation instead of the conventional channel estimation ifTTll . It 
is worthwhile to clarify whether we should use the accurate channel estimation in- 
stead of the conventional channel estimation when the QKD protocols involve the 
axis compensation. 

In the postprocessing phase, we employ the standard postprocessing. We do 
not use the noisy preprocessing lPT2l[T3l nor the two-way classical communication 
USED- 

In the axis compensation phase, we consider two kinds of compensations: 

(i) (one-side compensation) Only Bob is allowed to compensate his axis. 

(ii) (two-side compensation) Both Alice and Bob are allowed to compensate 
their axes. 

Furthermore in the BB84 protocol, we subdivide each compensation into two 
kinds. In the first kind, Bob (or both Alice and Bob) is allowed to compensate 
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his axis within the z-x plane of the Bloch sphere. In the second kind, Bob (or 
both Alice and Bob) is allowed to compensate his axis within any direction. The 
reason why we consider these two kind of compensations in the BB84 protocol 
is as follows. Since we only use the z-basis and x-basis in the BB84 protocol, 
it is natural to consider the axis compensation within the z-x plane. On the other 
hand, we might use the axis compensation within any direction if we are allowed to 
enhance the device for the compensation. Indeed, several researchers employ the 
compensation within any direction in the literature SSI [5] 0171 [US. Therefore, 
we also investigate the compensation within any direction. 

The optimized key generation rates (of the standard postprocessing) Fi(£), 
FtiS), F 2 (S), F 2 (£), Gi(£), Gi(£), G 2 (£), G 2 (£), 7i(£), 7i(£), / 2 (£), for 
above described 12 settings are summarized in Tabled] These quantities are for- 
mally defined in S ections l2~2l and [2731 respectively. 

Table 1: Summary of the optimized key generation rates for various settings. 
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In this paper, we investigate the above described optimized key generation 
rates, and derive closed-form expression of F\(S), F 2 (G), Gi(£), G 2 (£), 7i(£), and 
/ 2 (£) for unital channels. Since QKD protocols can be implemented over many 
different media, such as an optical fiber, free space, and an unknown medium, we 
should conduct theoretical research with general quantum channels. In this pa- 
per we deal with unital channels because we have closed-form expressions of key 
generations rates of the QKD protocols. The existence of such closed-form ex- 
pressions enables us to identify optimal compensation procedures. Without them 
identification is difficult. 

By using the closed-form expressions of the optimized key generation rates, 
we also derive the following relationships: 

F 2 (S) = F 2 (£) = F 1 (G) > F^S), 
G 2 (£) = G 2 (£) = G { (S) > Gi(£), 
/ 2 (S) = / 2 (£) > /i(£) > /i(£) 

hold for any unital channel, and 

FKfi) > Fi(£), 
Gi(£) > Gi(£), 
/!(£) > /!(£) 
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hold for general cases of unital channels. 

Our results provide the following important insight. In the literatures (3l 01 HI 
0|7]|8]|3, they employ the one-side compensation for the axis compensation phase 
and the conventional channel estimation for the channel estimation phase. How- 
ever, when we employ the one-side compensation, above mentioned relationships 
imply that we should use the accurate channel estimation. On the other hand, when 
we employ the two-side compensation, above mentioned relationships imply that 
we do not have to use the accurate channel estimation. 

The rest of this paper is organized as follows: In Section |2j we formally de- 
scribe the problem mentioned above for the six-state protocol and the BB84 proto- 
col. In Section |3j we provide closed-form expressions of the optimized key gener- 
ation rates, and also clarify the relationships among the optimized key generation 
rates for various settings. We state the conclusion in Section |4] 



2 Problem Formulation 



In this section, we formally describe the problem we investigate in this paper. Sup- 
pose that Alice and Bob are connected by a qubit channel £g from the set of all 
qubit density operators to themselves. As is usual in QKD literatures, we assume 
that Eve can access all the environment of channel £#; the channel to the environ- 
ment is denoted by Se- In the rest of this paper, we omit the subscripts B and E if 
they are obvious from the context. 

It should be noted that £ can be any qubit channel throughout the paper, unless 
we specify the channel to be a Pauli channel or a unital channel. 



2.1 Stokes parameterization and Choi Operator 

For convenience, we introduce the Stokes parameterization and the Choi operator 
for the qubit channel. The qubit channel £ can be described by the affine map 
parameterized by 12 real parameters |[T6l[T7l as follows: 
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(1) 



where (6 Z , 9 X , 6> y ) describes a vector in the Bloch sphere IPT811 . The pair (R, t) of the 
matrix and the vector in Eq. CD is called the Stokes parameterization of the channel 
£. In the rest of this paper, we identify the channel £ and its Stokes parameteriza- 
tion, and occasionally write £ = (R, t). 

For the channel £ and each pair of bases (a, b) e {z, x, y} 2 , define the biases of 
the outputs as 



Gabo := (0b|£ B (|0 a >(0 a |)|0 b >-(l b |£ B (|0 a ><0 a |)|l b >, 
Gabl := <lb|fi B (|la><lal)|lb>-<O b |£ B (|l a ><lal)|Ob>, 
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where |O a >, |l a ) are eigenstates of the Pauli operator cr a for a e {x, y, z} respectively. 
Then, a straight forward calculation shows the relations 

#ba = ^(GabO + Gabl), = ^(<2ab0 - <2abl)- (2) 

A unital channel is a channel that maps the completely mixed state 1/2 to itself. 
For a unital channel, the vector part (t z , t x , fy) of the Stokes parameterization is the 
zero vector. Furthermore, the channel is called a Pauli channel if the matrix part 
R of the Stokes parameterization is a diagonal matrix in addition to that the vector 
part is the zero vector. 

We can also describe the qubit channel £ by the Choi operator 

PAB :=(id®s B )mm, 

where \tfr) = l 00 ^. 11 ^ is a maximally entangled state. For the unital channel, the 
Choi operator satisfies Tr^lpAB] = J/2. Furthermore, the channel is a Pauli channel 
if and only if the Choi operator is a Bell diagonal operator, i.e., 

PAB = ^ <?al<Aa><^al 

ae{i,z,x,y) 

for Bell states \\fj a ) := (7 ® cr a )\ifj) and the probability distribution (q h q z , q x , g y ) on 
{i,z, x,y}, where cr\ is the identity operator. Throughout this paper, we omit the 
subscript AB if it is obvious from the context. 

2.2 Six-state protocol 

As the preparation phase of the six-state protocol, Alice and Bob conduct the fol- 
lowing axis compensation procedure. Alice randomly sends bit or 1 to Bob by 
modulating it into a transmission basis that is randomly chosen from the z-basis 
{|0 Z >,|1 Z >}, the x-basis {|0 X >, |l x >}, or the y-basis {|0 y >,|l y >}. Then Bob randomly 
chooses one of measurement observables o~ x , o~ y , and o~ z , and converts a measure- 
ment result + 1 or - 1 into a bit or 1 respectively. After a sufficient number of 
transmissions, Alice and Bob publicly announce their transmission bases and mea- 
surement observables. They also announce all of their bit sequences for estimating 
channel £. Note that Alice and Bob do not discard mismatched measurement out- 
comes, which are transmitted and received by different bases, and they also use the 
mismatched measurement outcomes to estimate the channel. From Eq. ©, we find 
that Alice and Bob can estimate all parameters (R, t) of the channel in the six-state 
protocol |[T9ll20l . Note that the use of the mismatched measurement outcomes for 
channel estimation is also known as the process tomography. 
We consider two kinds of compensations: 

(i) Only Bob is allowed to compensate his axis, i.e., the channel after the com- 
pensation is 

S' B = U B ° Sb, (3) 
where 14b is a unitary channel that represents Bob's compensation. 
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(ii) Both Alice and Bob are allowed to compensate their axes, i.e., the channel 
after the compensation is 



£b = %o8 8 o 14 a , 



(4) 



where 14a and 14b are unitary channels that represent Alice and Bob's com- 
pensations. 

Based on the estimate of the parameters (R, t), Bob (or both Alice and Bob) decides 
14b (or 14a and 14b), and he compensates the channel. The choice of 14b (or 14a 
and 14a) can be decided according to Theorem[2]and Corollary [3] of Section IXT1 

Remark 1 Throughout this paper, the prime represents that it is after the compen- 
sation. 

After the compensation procedure, Alice and Bob conduct the above bit trans- 
mission and reception procedure again. This time, they only announce a part of 
their bit sequence for estimating the channel £', and they conduct the postprocess- 
ing to generate a secret key from the remaining (unannounced) bit sequences. 

Henceforth, we focus on the postprocessing procedure for Alice's bit sequence 
xeFj that is transmitted in z-basis and corresponding Bob's bit sequence y e 
that is received in cr z measurement, where F2 is the finite field of order 2. We 
employ the standard postprocessing procedure that consists of the information rec- 
onciliation procedure and the privacy amplification procedure (e.g. see ifTTl Section 
2]). Note that we do not use the so-called noisy preprocessing |[T2llT3l nor the post- 
processing with two-way classical communication lTT4l[T5l . 



be the conditional von Neumann entropy with respect to the density operator 



on the joint system Hx ® He , where H{p) is the von Neumann entropy |[T8l for 
a density matrix p, and we take the base of the logarithm to be 2 throughout the 
paper. For the compensated channel £', we define the joint probability distribution 



Let 



H £ ,(X\E) := H(p' XE ) - H{p' E ) 





of the joint random variable (X, Y) on F2 x F2. Then, let 



H B ,(X\Y) :=- J] P' XY (x,y)logP' xlY (x\y) 



(5) 



.v,veF2 



be the conditional Shannon entropy of X given Y. 
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In the six-state protocol, since Alice and Bob can estimate the channel £' ex- 
actly if they use the accurate channel estimation, they can asymptotically share a 
secure key if the length I of the key satisfies 

- < H £ ,(X\E) - H £ ,(X\Y) 
n 

(see ETlfTTI ). Therefore, we consider the following two optimization problems: 

(i) Find a closed-form expression of 

Fi(6) := max[H e >(X\E) - H E ,(X\Y)], (6) 
'Ub 

and also find Hr that achieves the maximum in Eq. ((6]). 

(ii) Find a closed-form expression of 

F 2 (S) := max [H & (X\E) - H & (X\Y)], (7) 

'Ua.'Ub 

and also find (Ua^b) that achieve the maximum in Eq. ©. 

Eqs. © and (0 are the key generation rates optimized within the one-side com- 
pensation and the two-side compensation respectively. 

Next, we consider the case in which Alice and Bob use the conventional chan- 
nel estimation (see fTT) for the detail of the conventional estimation). From Eq. ©, 
we find that Alice and Bob can only estimate the parameters y' = (R zz ,R' xx ,R'yy), 
and they cannot estimate the parameters k' - (R' zx , R Z y, R' xz , R' X y, R'y Z , R'y X , t' z , t' x , 
t'y). Since we have to consider the worst case with respect to the parameters k' that 
cannot be estimated, we consider the following two quantities: 

Fi(£):=max min [H B (X\E) - H & (X\Y)] (8) 

and 

F 2 (B) := max min [Hg(X\E) - H B (X\Y)], (9) 

Ua,Ub SePAY) 

where V s {y') is the set of all channel for given y' , i.e., 

W) :={S = (y,K): y = y'\. 

Since the definition of F\{&) and F2{&) involve the minimization, we have F\{&) > 
Fi(S) and F 2 (B) > F 2 (B) (H). 
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2.3 BB84 protocol 



2.3.1 Compensation within z-x Plane 

The BB84 protocol is almost the same as the six-state protocol. However in the 
BB84 protocol with the axis compensation within the z-x plane, Alice uses only 
z basis and x basis to transmit the bit sequence, and Bob uses only observable cr z 
and cr x to receive the bit sequence. Therefore, from Eq. ©, we find that Alice 
and Bob can only estimate the parameters a> = (R zz ,R zx ,R xz ,R xx ,t z ,t x ), and that 
they cannot estimate the parameters r = (/? zy ,/? X y,/?y Z ,/?y X ,/?y y , fy). We consider 
the following two kinds of compensations: 

(i) Only Bob is allowed to compensate his axis within the z-x plane, i.e., the 
channel after the compensation is given by Eq. d3]), where 14b is a unitary 
channel that rotate the Bloch sphere within the z-x plane. 

(ii) Both Alice and Bob are allowed to compensate their axes within the z-x 
plane, i.e., the channel after the compensation is given by Eq. ©, where 
14a and 1A g are unitary channels that rotate the Bloch sphere within the z-x 
plane. 

Based on the estimate of the parameters a>, Bob (or both Alice and Bob) decides 
Hb (or Ha and 14b), and he compensates the channel. The choice of 14b (or Ha 
and 14b) can be decided according to Theorem|7]and Corollary [8] of Section [3.2. II 

As in the six-state protocol, we also employ the standard postprocessing. We 
first consider the case in which Alice and Bob use the accurate channel estimation. 
Note that Alice and Bob can only estimate the parameters a>' = (R' zz , R' zx , R' xz , R' xx , t' z , t' x ), 
and that they cannot estimate the parameters t' = (R' Z y, R' xy , R' yz , R'y X , R' yy , f y ). 

Let Pb a (a>') be the set of all channels for given a>', i.e., 

'Pbaiu') '■- {£ = (w, f) : O) = oj'). 

In the BB84 protocol, Alice and Bob can asymptotically share a secure key if the 
length I of the key satisfies 

-< min [H£(X\E) - H g (X\Y)] 

n SeP ba (aj>) 

(see ETlfTTI ). Therefore, we consider the following two optimization problems: 
(i) Find a closed-form expression of 

Gi(£):=max min [Hs(X\E) - HdX\Y)\ (10) 

and also find 14b that achieves the maximum in Eq. (flOl . where 14b is a 
unitary channel that rotates the Bloch sphere within the z-x plane. 
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(ii) Find a closed-form expression of 

G 2 (£):=max min [H B (X\E) - H & (X\Y)], (11) 

U A ,U B SeP ha (u') 

and also find (14 a, 14b) that achieve the maximum in Eq. (fTTT) . where 14a and 
14b are unitary channels that rotate the Bloch sphere within the z-x plane. 

Next, we consider the case in which Alice and Bob use the conventional chan- 
nel estimation. From Eq. ©, we find that Alice and Bob can only estimate the 
parameters y! = (R ZZ ,R' XX ), and they cannot estimate the parameters V - (R' zx , R' Z y, 
R' xz , R' X y, R'y Z , R'y X , R'yy , t' z , t' x , t'y) . Since we have to consider the worst case with 
respect to the parameters V that cannot be estimated, we consider the following 
two quantities: 

Gi(£) := max min [Hg(X\E) - H^(X\Y)], (12) 

and 

G 2 (£) ■- max min [H B (X\E) - Hg(X\Y)], (13) 

where PbciM') i s the set of all channel for given fi', i.e., 

Pbctf) := {& = Qi,v) : fi=//}. 

Since the range of the minimizations in the definitions of Gi(£), G2(£), Gi(£), and 
G 2 (£) satisfy P ba ((o') c P bc (ji'), we have Gi(£) > Gi(£) and G 2 (£) > G 2 (£) ITT1 . 

2.3.2 Compensation within Any Direction 

In this section, we consider the BB84 protocol with the axis compensation within 
any direction. We consider this problem because several researchers employ the 
compensation within any direction in the literatures (3l|4l|5j|6j|7J|8l|9l. 

When we employ the one-side compensation, Alice randomly sends or 1 
to Bob by modulating it into a transmission basis that is randomly chosen from 
the z-basis or the x-basis. Then Bob measures received qubits by randomly us- 
ing observables cr z , cr x or cr y . Note that Bob can use cr y in addition to <x z and 
cr x because he is allowed to rotate the axis of the receiver in the axis compensa- 
tion phase. In this case, from Eq. (O, we find that Alice and Bob can estimate 
the parameters (R zz ,R xz ,Ry Z ,R zx ,R xx ,Ry X ,t z ,t x ,ty), and they cannot estimate the 
parameters (R Z y,R X y,Ryy). Since Bob can use cr y , Alice and Bob can estimate 
(Ry Z , Ry X , ty) in addition to (R zz , R xz , R zx , R xx , t z , t x ), which can be estimated in the 
compensation scheme of Section 12.3.11 Based on the estimate of the parameters 
(R zz , R xz , Ry Z , R zx , R xx , Ry X , t z , t x , ty), Bob decide 14b and compensate the channel. 
The choice of 14b can be decided according to Theorem [12] of Section l3.2.2l 
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On the other hand, when we employ the two-side compensation, we allow both 
Alice and Bob to use z-basis, x-basis, and y-basis in the axis compensation phase. 
In this case, from Eq. (©, we find that Alice and Bob can estimate all of the param- 
eters (R,t). Based on the estimate of the parameters (R,t), Alice and Bob decide 
14a and 14b, and they compensate the channel. The choice of 14a and 14b can be 
decided according to Theorem [TT] of Section l3.2.2i 

In the bit transmission phase (after the axis compensation phase), we allow 
Alice and Bob to use only z-basis and x-basis. The channel estimation phase and 
the postprocessing phase are exactly the same as in Section I2.3.U Note that Alice 
and Bob can estimate (R' zz , R' xz , R' zx , R' xx , t' z , t' x ), but they cannot estimate the other 
parameters, because we do not allow neither Alice nor Bob to use y-basis in the 
bit transmission phase. Therefore, we consider the following two optimization 
problems: 

(i) Find a closed-form expression of 

/i(£):= max min [H 6 (X\E) - H 6 (X\Y)], (14) 

% SeP ba (tj>) 

and also find 14b that achieve the maximum in Eq. (fT4l . where 14b is any 
unitary channel. 

(ii) Find a closed-form expression of 

J 2 (B) := max min [H B (X\E) - H B (X\Y)], (15) 

UA,<UB&=P ba (0>') 

and also find (14a,14b) that achieve the maximum in Eq. (fT5T ). where 14a 
and 14 b are any unitary channels. 

We also treat the case in which Alice and Bob use the conventional channel 
estimation. In this case, we consider the following two quantities: 

/!(£):= max min [H 6 (X\E) - H 6 (X\Y)], (16) 

Ub SeP bc (fi') 

and 

/ 2 (£) := max min [H^X\E) - H & {X\Y)}, (17) 

where 14a and 14 b are any unitary channels. Since the range of the minimizations 
in the definitions of /i(£), /2(£), Ji(£>), and /2(£) satisfy Pba(<^') c Pb c (ji'), we 
have /Kfi) > 7i(£) and 7 2 (£) > OH- 

3 Optimal Compensation for Unital Channels 

In this section, we solve the problems formulated in Sections [2.2ll2.3.ll and !2.3.2l 
respectively for unital channels. 



l() 



3.1 Six-state protocol 



For any channel £ = (R, t), by the singular value decomposition, we can decom- 
pos^l] the matrix R as 



R = B diag[<? z ,e x ,e y ] A 

(B z \ 
(B x \ 
(B y \ 

(B Z \A Z ) 
(B X \A Z ) 

(By\A z ) 





e z 















e x 
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e V - 





\A Z ) \A X ) |A y > 



(B Z \A X ) (B z \A y ) 

<fl X |A X > (B X |iy> 
(By|A x ) <5y|Ay> 



(18) 



where A and B are the rotation matrice^l, \e z \, \e x \, and \e y \ are the singular values 
of R, and we set (A z \ = (e z A zz ,e x A zx ,e y A zy ), (A x \ = (e z A xz ,e x A xx ,e y A xy ), and 
<A y | = {e z A yz ,e x A yx ,e y A yy ). 

Henceforth, we identify Alice's compensation and Bob's compensation 14b 
with the 3x3 rotation matrices Oa and Ob- Then, the matrix part of the Stokes 
parameterization of the compensated channel £' = (7?', f) is given by 7?' = ObROa- 

The following theorem gives a closed-form expression of the key generation 
rate optimized by the two-side compensation. 

Theorem 2 Suppose that £ is a unital channel. Let 0* A = A' 1 and 0* B - B' 1 , and 
let tl* A and tl* B be the unitary channels corresponding to 0* A and 0* B respectively. 
Then, the compensated channel £* = tl* B o £ o tl* A is the Pauli channel such that 
the matrix part of the Stokes parameterization is given by R* - diag[e z , e x , e y ], and 
£* satisfies 



F 2 (6) - max [H E ,(X\E) - H £ ,(X\Y)] 

U A ,<U B 

= H G *(X\E) ~ H e *(X\Y) 
- 1 - H[q h q z ,q x ,q y ], 

where H[q\, q z ,q x , q y ] is the Shannon entropy lf22l of the distribution 

1 + e z + e x + e y 

q\ 

q y 







4 


1 + 


e z 


-e x -e y 






4 


1 - 


e z 


+ e x -e y 






4 


1 - 


e z 


- e x + e y 



(19) 

(20) 
(21) 



(22) 
(23) 
(24) 
(25) 



'The decomposition is not unique because we can change the order of (e z , e x , e y ) or the sign of 
them by adjusting the rotation matrices A and B. However, the result in this paper does not depends 
on a choice of the decomposition. 

2 The rotation matrix is the real orthogonal matrix with determinant 1. 
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Furthermore, the maximum in Eq. (fl9l ) is achieved without any compensation, i.e., 



H G (X\E) - H £ (X\Y) = H S -(X\E) - H G -(X\Y) 
if and only if the vectors |A Z ) and \B Z ) are scalar multiple of each other. 

The first statement implies that an optimal compensation procedure is to compen- 
sate the channel to a Pauli channel. The second statement implies that {Ua^b) 
achieving the maximum are not unique. 

The following corollary gives a closed-form expression of the key generation 
rate optimized by the one-side compensation. 

Corollary 3 Suppose that £ is a unital channel. Let 



O* - 

B ~ 



be a rotation matrix such that (0* B \ is a scalar multiple of {R zz ,R^ z ,R yz ), where 
(Obx\ an d (@By\ can be arbitrary as long as they constitute a rotation matrix, and 
let 14* the unitary channel corresponding to 0*„. Then, the compensated channel 



£* 



tf* B o £ satisfies 



Fi(6) - Hs>(X\E)-H E *(X\Y) 
= F 2 (£). 



□ 



Note that Corollary [3] follows from the second statement of Theorem El 

Surprisingly, we do not lose any optimality even if we only allow Bob to com- 
pensate his axis (one-side compensation). This fact is useful to simplify the imple- 
mentation of the optimal compensation procedure. 

Since H e (X\Y) = h{(\ + R zz )/2) for any unital channel and R zz = <S Z |A Z >, 
we find that an optimal one-side compensation procedure is to compensate the 
channel so that Bob can detect Alice's transmitted state most reliably, i.e., H&(X\Y) 
is minimized, where h(-) is the binary entropy function. Note that the fact that |A Z ) 
and \B' Z ) is scalar multiple of each other does not necessarily mean the compensated 
channel £' is a Pauli channel. 

Proof of Theorem |2]) The equality between Eqs. (1201 ) and (|2TT > is well known 
(e.g. see |[T2l or ifTTl Eq. (20)]). Since Eq. (fT9l ) is obviously larger than or equals 
to Eq. (I20l . it suffices to show that Eq. ( fl9l ) is smaller than or equals to Eq. (|2TT) 
for any Ha and tfs- For any fixed Ha and Kb, by using IfTTl Eq. (20)] and the 
discussions right before it, Eq. (fT9l) can be rewritten as 

1 -H[qi,q z ,q x ,q y ] + hi \-h\ I. 
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From the form of h(-), Cauchy's inequality |<fi z |A;>| < |||A^)|| implies that Eq. OH) 
is smaller than or equals to Eq. (I2TT) . The equality holds if and only if the vec- 
tors |A Z ) and \B' Z ) are scalar multiple of each other, which is exactly the second 
statement of the theorem. □ 
Next, we consider the case in which Alice and Bob use the conventional chan- 
nel estimation. The following theorem states that the optimized key generation 
rate with the accurate channel estimation coincides with that with the conventional 
channel estimation if we use the two-side compensation. The following theorem 
also gives the necessary and sufficient condition such that the optimized key gen- 
eration rates with the accurate channel estimation and the conventional channel 
estimation coincide when we use the one-side compensation. 

Theorem 4 Suppose that £ is a unital channel. Then, we have 

F 2 (£) = F 2 (£), 

where F 2 (£) is achieved by 0* A and 0* B specified in Theorem El Furthermore, we 
have 

Fi(6) - Fi(6) 

if and only if |A Z ), |A X ), and |A y ) are orthogonal to each other. If this condition is 
satisfied, then Fi(£) is achieved by 0* B such that (0* Bz \ and {0* Bx \ and {0* B ^\ are 
scalar multiple of (R Z z, Rxz, Ryz), (Rzx, Rxx, Ryx), and (R Z y, Rxy, Ryy) respectively. 

Corollary 5 Suppose that £ is a unital channel. Then, we have 

Fi(£) = F 2 (£) 

if and only if |A Z ), |A X ), and |A y ) are orthogonal to each other. □ 

Proof of Theorem^ Let £* be the Pauli channel defined in Theorem El Then, we 
have 

F 2 (£) > F 2 (£) 

> min [H g (X\E) - H B (X\Y)] 

= 1 - H[q\,q z ,q*,q^ 
= F 2 (£), 

which implies the first statement of the theorem. 

To prove the "if" part of the second statement, assume that |A Z ), |A X ), and 
| Ay) are orthogonal to each other. Then, we can take a rotation matrix 0* B so that 
(0* Bz \ and <0* x | and <6>g y | are scalar multiple of (R zz ,Rxz,Ryz), (Rzx,Rxx,Ryx), 
and (R Z y, Rxy, Ryy) respectively, and we have R' = 0* B R = diag[e z , e x , e y ]. Thus, we 
have 

Fi(£) > Fi(£) > 1 -H[q h q z ,q x ,q y ] = F^fi). 
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Next, we show the "only if" part of the second statement. Suppose that at least 
one pair of |A Z ), |A X ), and |A y ) is not orthogonal to each other. Then, for arbitrarily 
fixed 14b, the compensated channel &' is not a Pauli channel, i.e., the Choi operator 
p' is not a Bell diagonal state. Let p a := (a" a ® o~ a )p'(<x a ® cr a ) for a € {i,z, x, y}, 
where o- a is the complex conjugate of cr a . Since p' is not Bell diagonal state, at 
least one of p' z , p' x , and p y is different from p[. Let 

aeji,z,x,y| 

be the partially twirled state [23]. Then, since the von Neumann entropy is a strict 
concave function lPT8ll . we have 

Fi(£) = max[l - H(p w )\ 
u B 



< max[l- ^ i//(p a )] 



ae{i,z,x,y} 
- max[l - H(p')] 

= Fi(6). 



3.2 BB84 protocol 

3.2.1 Compensation within z-x Plane 

For any channel £ - (R, t), by the singular value decomposition, we can decompose 
the left upper 2x2 sub-matrix S of the matrix R as 



5 = 


= V diag[d z ,d x ] 


U 






' (V 2 | " 




d z 
















C?x 



[ \U Z ) \U X ) } 



(V Z \U Z ) (V Z \U X ) 

(Vy\U z ) <V x |f7 x > 



where U and V are the rotation matrices, \d z \ and |<i x | are the singular values of 5, 
and we set (U z \ = (d z U zz ,d x U zx ) and (t7 x | = (d z U xz ,d x U xx ). 

Henceforth, we identify Alice's compensation Ha and Bob's compensation 
14b with the 2 x 2 rotation matrices <2a and Qb, because their compensation are 
restricted within the z-x plane. Note that the left upper 2x2 sub-matrix S ' of the 
matrix R' of the compensated channel is given by S' = QbSQa- 

The following lemma provides a closed-form expression of the key generation 
rate with the accurate channel estimation for unital channels, and it will be used 
several times in the rest of this paper. 
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Lemma 6 For any unital channel £ = {oj, t), we have 



min [H B {X\E)-H B {X\Y)} 



1+ ^Rlz + Rlz 



Proof of Lemma [6]) This lemma follows from i fTTl Proposition 2] and the fact 
fle(X|F) = + /?zz)/2) for any unital channel. □ 
The following theorem gives a closed-form expression of the key generation 
rate optimized by the two-side compensation. 

Theorem 7 Suppose that £ is a unital channel. Let Q* A = U~ l and Q* B = V~ l , and 
let tl* A and tl* B be the unitary channels corresponding to Q* A and Q* B respectively. 
Then, the compensated channel K B o £ o K* A =: £* - {oj* , r*) satisfies 

G 2 (£) - max min [He(X\E) - Hr(X\Y)] (26) 
- min [H B (X\E) - H g (X\Y)] (27) 

,_*(i±*Wi±*\ (28) 



Furthermore, the maximum is achieved without any compensation, i.e., 
min [Hg(X\E) - H 6 (X\Y)] = min [H B (X\E) - Hg(X\Y)] 

if and only if the vectors \U Z ) and \ V Z ) are scalar multiple of each other. 

The first statement implies that an optimal compensation procedure is to compen- 
sate the channel to a channel such that the left upper sub-matrix S' of the Stokes 
parameterization of the compensated channel is a diagonal matrix. The latter state- 
ment implies that (Ua^b) achieving the maximum is not unique. 

By using Theorem 13 we can derive the following corollary, which gives the 
key generation rate optimized by the one-side compensation. 



Corollary 8 Suppose that £ is a unital channel. Let 

Q*B = 



<<2*„J 



be a rotation matrix such that (Q* Bz \ is a scalar multiple of (/? Z z>^xzjE and let 
tf* B be the unitary channel corresponding to 0* B . Then, the compensated channel 



3 Note that {Qb.x\ is uniquely determined from (QbA because they constitute a rotation matrix. 
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W* b oS=:S* = (co*,t*) satisfies 

Gi(6) - min [H S (X\E) - H B (X\Y)] (29) 

S€P ba (cO*) 

= G 2 (£). (30) 

□ 

Note that Corollary [8] follows from the latter statement of Theorem |7J 

Surprisingly, we do not lose any optimality even if we only allow Bob to com- 
pensate his axis (one-side compensation). This fact is useful to simplify the imple- 
mentation of the optimal compensation procedure. 

Since H £ (X\Y) = h((l + R zz )/2) for any unital channel and R zz = (V Z \U Z ), we 
find that an optimal one-side compensation procedure is to compensate the channel 
so that Bob can detect Alice's transmitted state most reliably, i.e., H&(X\Y) is mini- 
mized. Note that the fact that \ U Z ) and |V^> is scalar multiple of each other does not 
necessarily mean that the left upper sub-matrix S ' of the Stokes parameterization 
of the compensated channel is a diagonal matrix. 

Proof of Theorem^ By using Lemma [6l we have the equality between Eqs. (1271) 
and (1281) . Since Eq. (l26l ) is obviously larger than or equals to Eq. (|27T ). it suffices to 
show that Eq. (l26l ) is smaller than or equals to Eq. (l28l) . For any fixed 14a and 14b, 
by using Lemma [6] again, Eq. (l26l ) can be rewritten as 

i-*(l±*)-*(l±*)->(l±^i)-*(l±<S!^). 

From the form of h(-), Cauchy's inequality |<V z l^z>l ^ \\\U' Z )\\ implies that Eq. ([26]) 
is smaller than or equals to Eq. (I28l) . The equality holds if and only if the vec- 
tors \U' Z ) and \V Z ) are scalar multiple of each other, which is exactly the second 
statement of the theorem. □ 
Next, we consider the case in which Alice and Bob use the conventional chan- 
nel estimation. The following theorem states that the optimized key generation 
rate with the accurate channel estimation coincides with that with the conventional 
channel estimation if we use the two-side compensation. The following theorem 
also gives the necessary and sufficient condition such that the optimized key gen- 
eration rates with the accurate channel estimation and the conventional channel 
estimation coincide when we use the one-side compensation. 

Theorem 9 Suppose that £ is a unital channel. Then, we have 

G 2 (£) - G 2 (£), 

where (5i(£) is achieved by Q* A and Q* B specified in Theorem [7] Furthermore, we 
have 

d(£) = Gj(£) 
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if and only if \U Z ) and \ U X ) are orthogonal to each other. If this condition is sat- 
isfied, Gi(£) is achieved by Q* B such that (Q* Bz \ and (Q* Bx \ are scalar multiple of 
(Rzz,Rxz) and (R z *,Rxx) respectively. 

Corollary 10 Suppose that £ is a unital channel. Then, we have 

Gj(£) = G 2 (£) 

if and only if \U Z ) and |t/ x ) are orthogonal to each other. □ 
Proof of Theorem^ Let £* be the channel denned in Theorem [7] Then, we have 

G 2 (£) > G 2 (£) 

> min - 



= G 2 (£), 

which implies the first statement of the theorem. 

To prove the "if" part of the second statement, assume that \U Z ) and |t7 x ) are 
orthogonal to each other. Then, we can take a rotation matrix Q* B so that (Q* Bz \ 
and (Q* Bx \ are scalar multiple of (R Z z,Rxz) and (R zx ,Rxx) respectively, and we have 
5' = Q* B S = diag[c? z , d x ]. Then, we have 

Gm = G l( £) > 1 - h( i±^) - A ( = G l( £). 



Next, we show the "only if" part. Suppose that \U Z ) and \U X ) are not orthogonal 
to each other. Then, for an arbitrarily fixed either (V Z \U X ) t or (V X \U Z ) t 
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holds. Then, we have 



Gi(£) = \-h 



< \-h 



l + {Vz\U z )\ ,(l + (V x \U x ) 



-h 



1 + \\\U Z 



-h 



l-h 



2 U 2 + d 2 U 2 

Z U ZZ TU X U zx 



2 

lllfic) 
2 
\ 



-h 



1+ Jd 2 U 2 xz + d 2 x U 2 xx 



< 1 - 



1 + Jd 2 z 



U 2 zx h 



1 + Jd 2 



- u 2 xz h 



= \-{U 2 zz + U 2 xz )h 



1 + ^d 2 


~ U 2 xx h 


1 + ^d 2 x 


2 


2 






\ ) 



= Gi(6), 

where we used the concavity of the function 



l+d x 



(31) 



(32) 



in the inequality of Eq. (f3TT >. We can show the concavity of Eq. (1321 by showing 
that the second derivative is non-positive. □ 



3.2.2 Compensation within Any Direction 

In this section, we consider the case in which either Alice or Bob are allowed to 
compensate their axes within any direction (3l 01 \5\ |7J [8j |5)- For any channel 
£ = (R, t), by the singular value decomposition, we can decompose the matrix 
7? as in Eq. (TT8T ). Furthermore, we identify Alice's compensation 14a and Bob's 
compensation Hb with the 3x3 rotation matrices Oa and Ob as in Section |3~T1 
When we consider the compensation within any direction, it should be noted that 
we can estimate all the parameters in the two-side compensation and only a part of 
the parameters in the one-side compensation (see also Section l2.3.2l ). 

The following theorem gives the key generation rate optimized by the two- side 
compensation. 
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Theorem 11 Suppose that £ is a unital channel. Let < U* A and H* B be unitary 
channels such that the compensated channel tl* B o £ o tl* A =: £* = (o>*,t*) is 
a Pauli channel and the singular values |e*|, and of /?* = diag[e*, e*, e*] 
satisfy 



Then, we have 



kzi > k\ > \e;\ 



7 2 (£) - max min [Hs(X\E) - Hs(X\Y)] (33) 

< WA,%£en iI (^') 

= min - tfg(X|y)] (34) 

..J^.JilfiV (35) 



Proof of Theorem 1771) By using Lemma[6j we have the equality between Eqs. (I3"4"l) 
and (l35l) . Since Eq. d33l is obviously larger than or equals to Eq. (l34l . it suffices to 
show that Eq. (1331 is smaller than or equals to Eq. d35l) . 
For any fixed 1/^ and Theorem |7J implies 

min - #e(X|y)] 

< G 2 (£') 

= i-h\—^\-h[—±\, (36) 



where IJ^I and \d' x \ are the singular values of the left upper 2x2 sub-matrices 5' of 
R' of the compensated channel £'. 

Note that the singular values of R' are equal to those of R*. By using the 
interlacing inequalities for singular values of sub-matrices E41 . we have 

k*| > max[|4lX|] 

and 

Kl>min[|4|,K|]. 



These inequalities imply that Eq. (1361 ) is smaller than or equals to Eq. (T35I ). which 
completes the proof. □ 
The following theorem gives the key generation rate optimized by the one-side 
compensation. 

Theorem 12 Suppose £ be a unital channel. Let 
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be a rotation matrix such that (0* Bz \ and (0* Bx \ span the same subspace as that 
spanned by (R zz , R xz , R yz ) and (R zx , R xx , Ryx), and that (0* B z | is a scalar multiple of 
(R zz , R xz , R yz j^, and let 1f* B be the unitary channel corresponding to 0* B . Then, the 
compensated channel tl* B o £ =: £* - (of , r*) satisfies 



/i(£) = max min [H & (X\E) - H g (X\Y)] 

Kb EeP ba ((o') 

= min [H g (X\E) - H B (X\Y)] 



= 1 -h 



1 + s\ 



-h 



1 + s* 



(37) 
(38) 

(39) 



where s* and s* are the singular values of the upper left 2x2 sub-matrix matrix 



S* = 



(B* Z \A Z ) (B* Z \A X ) 
(B* X \A Z ) (B* X \A X ) 



ofR* = 0* B R such that j* > jr*. 

Proof of Theorem[T2\) The second statement of Theorem |7] implies that the equality 
between Eqs. d38l) and (1391 . Since Eq. (l37l) is obviously larger than or equals to 
Eq. (1381) . we show that Eq. (1371 ) is smaller than or equals to Eq. d39l ). 

For arbitrarily fixed Ob, let j'j and s' 2 be the singular values of the upper left 
2x2 matrix 



S' = 



(B' Z \A Z ) {B' Z \A X ) 
(B' X \A Z ) (B' X \A X ) 



of R' - ObR such that s\ > s'. Then, by using Corollary [U we have 



min [Hg(X\E) - Hg(X\Y)] 



< Gi(6') 



= 1 -h 



1 + s' 



1 + si 



(40) 



By using the minimax principle for singular values M251 Problem 3.6.1], we 



Note that (0 B . V \ is uniquely determined from (0 B ,A and {0 B A because they constitute a rotation 
matrix. 
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have 



Si - 



max ||5'x|| 

xeR 2 :\\x\\=1 



max 

aJJeR 
Qr 2 +/3 2 = 1 



max 

aJ3eR 



(B' Z \A Z ) (B' Z \A X ) 1 [ a 
(B' X \A Z ) (B' X \A X ) \ [ B 

(B z \(a\A z ) + B\A x )) 
{B' x \{a\A z ) + B\A X )) 



^(B' z \r afi ) 2 + (B' x \r afi y 

max J{B* z Wafi) 2 + (Bl\T afi ) 2 



max 

aJleR 
a 2 +p 2 =l 



cv./!eli 
or 2 +/? 2 = l 



= ^1 



(41) 



(42) 



where we set 11^) := a\A z ) + B\A X ), and the equality in Eq. (|4TT) holds if \B' Z ) 
and \B' X ) span the same subspace as that spanned by \A Z ) and |A X ). By using the 
minimax principle for singular values in a similar manner, we also have 



s 2 = min \\S'x\\ < s* 2 . 



(43) 



Combining Eqs. (l40l) . (|42l) . and (l43l) . we have shown that Eq. (1371 ) is smaller 
than or equals to Eq. d39l ). □ 



/!(£) - 7 2 (£) 



Remark 13 The equality 



does not hold in general. For example, /i(£) + ^2(£) if R - diag[e z ,e x ,e y ] and 

kzl < kxl < k y |. 

Next, we consider the case in which Alice and Bob use the conventional chan- 
nel estimation. The following theorem states that the optimized key generation 
rate with the accurate channel estimation coincides with that with the conventional 
channel estimation if we use the two-side compensation. The following theorem 
also gives the necessary and sufficient condition such that the optimized key gen- 
eration rates with the accurate channel estimation and the conventional channel 
estimation coincide. 



Theorem 14 Suppose that £ is a unital channel. Then, we have 

/ 2 (£) = / 2 (£), 

where 72(£) is achieved by 0* A and 0* B specified in Theorem [TTJ Furthermore, we 
have 

/!(£) - 7i(£) 
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if and only if \A Z ) and |A X ) are orthogonal to each other. If this condition is satisfied, 
then J\{&) is achieved by 0* B such that (0* Bz \ and (0* Bx \ are scalar multiple of 
(Rzz,R*z,Ryz) and (R Z x,Rx*,Ryx) respectively. 

Corollary 15 Suppose that £ is a unital channel. Then, we have 

/!(£) < 7 2 (£) 

if \A Z ) and |A X ) are not orthogonal to each other. □ 

Proof of Theorem \14\ This theorem can be proved almost in a similar manner to 
Theorem |9l Therefore, we omit the proof. □ 

4 Conclusion 

In this paper, we investigated the axis compensation in the QKD protocols in var- 
ious settings. We clarified optimal compensation procedures over unital channels 
for one-side compensation with the accurate channel estimation and for two-side 
compensation with both estimation, while we could not identify an optimal com- 
pensation procedure for one-side compensation with the conventional channel es- 
timation. Although our proposed compensation procedures are optimal for unital 
channels, it is not clear whether those compensation procedures are optimal or not 
for general channels. We also clarified that the optimized key generation rates 
with the conventional channel estimation are strictly smaller than the optimized 
key generation rates with the accurate channel estimation for the one-side compen- 
sation. Our results imply that we should use the accurate channel estimation when 
we employ the one-side compensation. On the other hand, we do not have to use 
the accurate channel estimation when we employ the two-side compensation. 

Although we clarified the optimal compensation procedures for the standard 
postprocessing, it is an important future research agenda to clarify the optimal com- 
pensation procedures when we employ more complicated postprocessing (e.g. the 
postprocessing with the noisy preprocessing lPT2"l[T3l or the two-way classical com- 
munication lfT4l[T5l ). 
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